Issues

• Metadata-only session reads ignore a profile stored after messages: another profile sees the session, its owner gets 404

  bugprioritysecurity
  nesquena/hermes-webui#8857 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Refused cross-profile uploads still run Session.load's save on the other profile's sidecar

  bugprioritysecurity
  nesquena/hermes-webui#8855 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• A copied sidecar whose body names another session overwrites that session's conversation on its first load

  bugdata-losspriority
  nesquena/hermes-webui#8852 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Test-order flake: leaked STREAMS row from orphan-stream tests freezes the CLI-sessions cache and fails two idle-cache tests

  bugpriority
  nesquena/hermes-webui#8850 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Docker: opt-in Agent extras (e.g. firecrawl) are never installed into /app/venv

  bugdocker
  nesquena/hermes-webui#8849 · Filter by author gakugaku opened on Nov 5, 2026 · Critical Bug Fix
  1

• Plugin-registered redaction patterns are skipped by WebUI's prefilter (and vault values bypass the redaction cache)

  bugprioritysecurity
  nesquena/hermes-webui#8847 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• test_security_redaction.py leaves api.helpers bound to a stub agent.redact, so a later runtime-registration test fails

  bugpriority
  nesquena/hermes-webui#8845 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Small-string redaction cache serves stale output after a plugin registers a redaction pattern

  bugprioritysecurity
  nesquena/hermes-webui#8844 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• bug(updates): agent update on stable v0.52.544 pulls origin/main (legacy v2026.x tag series outranks v0.22.x)

  bugpriority
  nesquena/hermes-webui#8843 · Filter by author olegbc1 opened on Nov 5, 2026 · Critical Bug Fix
  1

• SSE lease rotation follow-ups (#7139): false sse_error per tab every 5 min on gateway stream; chunked mode omits terminating chunk

  bug
  nesquena/hermes-webui#8842 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Two custom providers sharing a name can pair one record's API key with the other's URL (custom vs custom, outside #8690's guard)

  bugprioritysecurity
  nesquena/hermes-webui#8841 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Scroll pill: tell "new content" apart from "layout grew" (false "New message" after a search jump with transcript virtualization on)

  bugux
  nesquena/hermes-webui#8839 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Backlog — Icebox

• Deleting a shared conversation leaves its public link live; a share racing the delete brings the conversation back

  bugprioritysecurity
  nesquena/hermes-webui#8837 · Filter by author nesquena-hermes opened on Nov 5, 2026 · Critical Bug Fix

• Refused cross-profile requests still run Session.load's save on the other profile's sidecar

  bugprioritysecuritysprint-candidate
  nesquena/hermes-webui#8834 · Filter by author nesquena-hermes opened on Nov 4, 2026 · Critical Bug Fix

• idx_messages_session_role is not covering: sidebar listing does ~100 MB of random reads per call

  bugperformanceprioritysprint-candidate
  nesquena/hermes-webui#8828 · Filter by author jabeny11 opened on Nov 4, 2026 · Critical Bug Fix
  1

• Context indicator shows a 256K window for a local model behind a sole legacy custom provider (range regression since .597)

  bugpriority
  nesquena/hermes-webui#8827 · Filter by author nesquena-hermes opened on Nov 4, 2026

• Archive upload: duplicate, empty or over-long member names give a generic error (500 on /api/upload/extract) instead of a clear 400

  bugsprint-candidate
  nesquena/hermes-webui#8826 · Filter by author nesquena-hermes opened on Nov 4, 2026 · Backlog — Icebox

• Context-length metadata lookup sends a provider record's key to an overriding URL (model.base_url, session URL, keyless alias); pre-existing on v0.52.544

  bugprioritysecurity
  nesquena/hermes-webui#8822 · Filter by author nesquena-hermes opened on Nov 4, 2026
  2

• Gateway mode: refuse in-process-only features with a clear error instead of provider-auth failures

  bug
  nesquena/hermes-webui#8821 · Filter by author samikrc opened on Nov 4, 2026 · Critical Bug Fix
  1

• Context-length lookup: the generic-custom branch adopts a native custom:<x> record by URL or model (since exp-v0.52.597)

  bugpriority
  nesquena/hermes-webui#8820 · Filter by author nesquena-hermes opened on Nov 4, 2026
  2

• Memory release gives up on the construction fence without keeping its cleanup intent; the evicted provider's writer runs until restart (residual of #8804/#8613)

  bugpriority
  nesquena/hermes-webui#8817 · Filter by author nesquena-hermes opened on Nov 4, 2026

• Context-length lookup sends a native custom:<builtin> provider's key to the built-in endpoint (residual of #8685, exp-v0.52.597)

  bugprioritysecuritysprint-candidate
  nesquena/hermes-webui#8816 · Filter by author nesquena-hermes opened on Nov 4, 2026
  1

• Samsung photos fail _is_complete_jpeg (SEF trailer after EOI), so every session GET regex-redacts megabytes of base64

  bugperformanceprioritysessionsprint-candidate
  nesquena/hermes-webui#8805 · Filter by author jan-demsar opened on Nov 4, 2026 · Critical Bug Fix
  1

• Sidebar: under All profiles, lineage enrichment writes the active profile's state.db metadata onto another profile's same-id session

  bugsession
  nesquena/hermes-webui#8799 · Filter by author nesquena-hermes opened on Nov 3, 2026 · Critical Bug Fix

• fix(sessions): mid-UTF-8 sidecar truncation aborts saving a valid in-memory snapshot

  bugprioritysession
  nesquena/hermes-webui#8798 · Filter by author nesquena-hermes opened on Nov 3, 2026 · Critical Bug Fix